18 October 2010

File Times

Occasionally it may be necessary to determine the various times of a file.
These times break down to access (when the file was last accessed),
modification (time of last modification), and inode (time of last
modification of the inode (mode / permission changes, etc.).  FreeBSD,
Solaris, and Linux have various means of determining this information,
one of which being /bin/ls.  The output from this command is nearly
identical for these OS types:

        host [0] /bin/ls -lt /etc/passwd
        -r--r--r--   1 root     sys          865 Mar  8 15:38 /etc/passwd

The option, -t, specifies to display the time of the last modification
of the file.  (This is the default timestamp printed when only the -l
option is specified.)

        host [0] /bin/ls -lu /etc/passwd
        -r--r--r--   1 root     sys          865 Aug  4 01:23 /etc/passwd

The option, -u, specifies to display the time of the last access to the
file, perhaps for a read, etc.

        host [0] /bin/ls -lc /etc/passwd
        -r--r--r--   1 root     sys          865 Aug  4 16:33 /etc/passwd

The option, -c, specifies the displaying of the inode modification time,
which may be impacted by things such as changing the files permissions,
the initial creation of the file, if a directory, the adding of files,
etc.  It should be noted that while the inode time is set at the time of
a file's creation, it should not be relied upon as the creation time as
the inode time can easily be changed following any number of activities.
Also of note, the -l option is necessary in each command as otherwise
the output expected is not visibly printed to STDOUT.

A means of determining all three of these times at once on FreeBSD exists
in the stat command:

        bsdhost [0] /usr/bin/stat -x /etc/passwd
          File: "/etc/passwd"
          Size: 1627         FileType: Regular File
          Mode: (0644/-rw-r--r--)     Uid: (  0/  root)  Gid: (  0/  wheel)
        Device: 4,14   Inode: 71000    Links: 1
        Access: Sun Jul 30 01:14:02 2006
        Modify: Thu Jun 22 14:19:44 2006
        Change: Fri Aug  4 16:38:58 2006

The -x operand simply tells stat to "Display information in a more
verbose way as known from some Linux distributions."

Speaking of Linux and quite similar to the FreeBSD output:

        linhost [0] /usr/bin/stat /etc/passwd
          File: `/etc/passwd'
          Size: 1814            Blocks: 8          IO Block: 4096   regular file
        Device: 801h/2049d      Inode: 952083      Links: 1
        Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
        Access: 2006-08-10 21:58:21.000000000 -0400
        Modify: 2006-08-04 21:12:46.000000000 -0400
        Change: 2006-08-04 21:12:46.000000000 -0400

On Solaris, a slightly more obscure method exists via truss, providing
essentially the same information as the FreeBSD or Linux stat commands:

        sunhost [0] /usr/bin/truss -vlstat -tlstat ls -l /etc/passwd
        lstat64("/etc/passwd", 0x08046930)              = 0
            d=0x00D80040 i=288   m=0100644 l=1  u=0     g=3     sz=751
                at = Aug  4 16:39:36 EDT 2006  [ 1154723976 ]
                mt = Jul 11 16:05:18 EDT 2006  [ 1152648318 ]
                ct = Aug  4 16:42:30 EDT 2006  [ 1154724150 ]
            bsz=8192  blks=2     fs=ufs
        -rw-r--r--   1 root     sys          751 Jul 11 16:05 /etc/passwd

The operands of -tlstat and -vlstat tells truss to trace specifically the
lstat system call and to be verbose about said tracing (respectively).
The "ls -l" is the specific command in which truss is following.

No comments: